Write each finding in five parts: condition, criteria, cause, consequence and corrective action. Rate it on a likelihood and impact matrix whose bands you set, then copy the text or export it.
The grey examples show the style only. Write the facts of your own engagement and keep the evidence reference in the working paper.
The matrix bands are your own. Use the thresholds in the engagement methodology or the client's risk policy and keep them the same across findings in a report.
A good finding answers five questions. What did you see, what should have been there, why is it different, why does it matter, and what should change. Leaving out the cause leads to fixes that treat symptoms. Leaving out the consequence leaves management unsure how urgent the finding is. Rating each finding on the same matrix lets the report put the serious ones first.
You score likelihood and impact from 1 to 5. The tool multiplies them to give a score from 1 to 25.
You set the scores at which the rating becomes Medium, High and Critical. Below the Medium score the rating is Low. The tool then assembles the five parts and the rating into one block of text you can copy into a report.
It also tells you which of the five parts are still blank.
Likelihood 4, impact 4, with Medium from 5, High from 10 and Critical from 16.
